518c5a69231dc87391896be44c5f7c9d36ec375d4c2878b6783869cce8da1133

Analysis

max time kernel
161s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 13:02

Target

SuperOneClickv1.5.5/SuperOneClickv1.5.5/1.push.bat
Size

104B
MD5

e2095ac4aeef2027f8267d308e55188b
SHA1

cc27a098e435ddeed2960fecc9f35f82269415f7
SHA256

d0be1f4a950cdd41d0f832c45b728a2e71bd428713d7fd724abd8a1f57626cb4
SHA512

93e811623b7b911f138baf86c9d2adaf41bd703f26c3decf97d211a48a1519511f0e5e191a2345771896289d7e47efc69db74fd299f6e998e37f7079aa143a1b

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 2604	112	cmd.exe	19
PID 112 wrote to memory of 2604	112	cmd.exe	19
PID 112 wrote to memory of 2604	112	cmd.exe	19
PID 2604 wrote to memory of 4724	2604	adb.exe	92
PID 2604 wrote to memory of 4724	2604	adb.exe	92
PID 2604 wrote to memory of 4724	2604	adb.exe	92
PID 112 wrote to memory of 5068	112	cmd.exe	98
PID 112 wrote to memory of 5068	112	cmd.exe	98
PID 112 wrote to memory of 5068	112	cmd.exe	98
PID 112 wrote to memory of 4828	112	cmd.exe	99
PID 112 wrote to memory of 4828	112	cmd.exe	99
PID 112 wrote to memory of 4828	112	cmd.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\1.push.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\adb.exe
  adb devices
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\adb.exe
    adb fork-server server
    3⤵
    PID:4724
- C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\adb.exe
  adb push flash_image /data/local/flash_image
  2⤵
  PID:5068
- C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\adb.exe
  adb push misc.img /data/local/misc.img
  2⤵
  PID:4828